AbuseIPDB » 89.149.91.237
89.149.91.237
This IP was reported 5 times. Confidence of
Abuse
is 4% : ?
ISP
ORANGE MOLDOVA S.A.
Usage Type
Fixed Line ISP
ASN
AS25454
Hostname(s)
static.89.149.91.237.net.md
Domain Name
orange.md
Country
🇲🇩
Moldova (the Republic of)
City
Chisinau, Chisinau Municipality
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 89.149.91.237 :
This IP address has been reported a total of
5
times from
3 distinct
sources.
89.149.91.237 was first reported on
January 22nd 2026 , and the most recent report was
1 day ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇺🇸
TPI-Abuse
2026-10-26 01:54:51
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 89.149.91.237 (static.89.149.91.237.net.md): 1 ...
show more
(mod_security) mod_security (id:210730) triggered by 89.149.91.237 (static.89.149.91.237.net.md): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 21:54:46.794995 2026] [security2:error] [pid 26935:tid 26935] [client 89.149.91.237:40253] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||batw.net|F|2"] [data ".borzois.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "batw.net"] [uri "/borzois.com/www.borzois.com"] [unique_id "at6y5tkMqc7rdmJ3y39JVAAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 06:16:09
(4 weeks ago)
(mod_security) mod_security (id:210350) triggered by 89.149.91.237 (static.89.149.91.237.net.md): 1 ...
show more
(mod_security) mod_security (id:210350) triggered by 89.149.91.237 (static.89.149.91.237.net.md): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 02:16:03.618906 2026] [security2:error] [pid 21923:tid 21923] [client 89.149.91.237:21616] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||dualspiralsystems.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "dualspiralsystems.com"] [uri "/"] [unique_id "artXo99_5aBX-L8dmvdebAAAAAI"], referer: https://bulkbacklinklookup.site/dir/ranking-focused-backlinks-59583
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-08-10 20:55:08
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
kosada.com
2026-07-06 20:42:36
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
2026-01-22 10:59:23
(9 months ago)
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ...
show more
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in thread-skip.asp
show less
Bad Web Bot
Exploited Host
Showing 1 to
5
of 5 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: